' This script file was created from other bits of scripts on the web
Const UF_TRUSTED_FOR_DELEGATION = &H80000

Set args = Wscript.Arguments
 
' Terminate unless two arguments are specified when starting
'the script
If args.Count <> 1 Then
    Wscript.Echo "You must provide a server name and delegation command line."
    Wscript.Echo "For example, start the script using syntax similar to this:"
    Wscript.Echo "cscript.exe machinedelegation.vbs <Server>"
    Wscript.Quit 1
End If

AlterServer args(0)


Public Sub AlterServer(serverName)
 
    ' Connect locally and get the domain and DS_Computer object to
    ' examine and/or modify
    Set svc = GetObject("winmgmts:root\cimv2")
     
    ' Get some local machine variables to understand the environment we are working in
    
    Set objEnum = svc.ExecQuery _
        ("Select domain, name From win32_computerSystem", "WQL", 48)
     
    For Each obj In objEnum
        domain = obj.domain
        computerName = obj.Name
    Next
     
    ' Get the connection to the root\directory\ldap namespace to enable delegation
    ' on the remote computer from the local machine
    
    Set svc = GetObject("Winmgmts:root\directory\ldap")
     
    ' Create the required context object
    
    Set octx = CreateObject("wbemscripting.swbemnamedvalueset")
    octx.Add "__PUT_EXT_PROPERTIES", Array("ds_userAccountControl")
    octx.Add "__PUT_EXTENSIONS", True
    octx.Add "__PUT_EXT_CLIENT_REQUEST", True
     
    ' Variable to determine whether or not we have modified the userAccountControl
    'and whether or not we have to modify it back when we are done
    
    Modified = False
     
    Set objEnum = svc.ExecQuery _
        ("Select * From ds_computer Where ds_cn = '" & serverName & "'", "WQL", 48)
     
    For Each obj In objEnum
     
    ' Store this variable to memory for restoration after this operation completes
    
        userAccountControlOriginal = obj.ds_userAccountControl
     
    ' Test to see if the computer is already trusted for delegation
        If CBool(userAccountControlOriginal And UF_TRUSTED_FOR_DELEGATION) = False Then
     
            Wscript.Echo "Computer account not trusted for delegation yet"                            
            ' Resume On Error while we try this initially
            On Error Resume Next
     
            ' Add this constant value to the value contained already
            obj.ds_userAccountControl = userAccountControlOriginal + _
                UF_TRUSTED_FOR_DELEGATION
     
            ' This should trust the computer account for delegation
            obj.put_ 1, octx
     
            If (Err.Number = 0) Then
            ' Set the flag so we know to modify it back to original setting
                Modified = True
            Else
                Wscript.Echo Hex(Err.Number) & " " & _
                    Err.Description
                Wscript.Quit 1
            End If
			Wscript.Echo "Computer account is now trusted for delegation"                            
			On Error GoTo 0:
     
        Else
        ' Already trusted for delegation so
        ' continue with delegation code here
            Wscript.Echo "Computer account is trusted for delegation already"
     
        End If
     
        ' Get the locator object
        Set lctr = CreateObject("WbemScripting.SWbemLocator")
     
        ' Get the service object from the remote server specifying the Kerberos authority
        Set delegationService = lctr.ConnectServer _
            (serverName, "root\cimv2", , , , _
                "kerberos:" & Trim(domain) & "\" & Trim(serverName))
     
        ' Delegation level impersonation
        delegationService.Security_.ImpersonationLevel = 4
     
        ' Get the object that will be used to test the delegation hop
        Set process = delegationService.Get("win32_process")
     
    Next

End Sub


